Privacy Policy · RideAuction

RIDEAUCTION CANADA — PRIVACY NOTICE This notice explains how RideAuction Canada collects, uses and discloses personal information of the people who use it on behalf of dealerships — dealership representatives and staff — and of others involved in a sale, such as pickup contacts, delivery recipients and carriers' drivers. ──────────────────────────────────────── 1. WHO WE ARE ──────────────────────────────────────── 1.1 RideAuction is operated by the Ride entity named below, which is responsible for the personal information described in this notice. ──────────────────────────────────────── 2. WHAT WE COLLECT AND WHY ──────────────────────────────────────── 2.1 Dealership registration. To verify a dealership: the business's legal name, address, phone, email, business number, dealer licence and its expiry, GST/HST, QST and PST numbers, and the representative's name, title, email and phone. Supporting documents may include the dealer licence, proof of business and the representative's government-issued identification. 2.2 Staff accounts. To let staff act for a dealership: each staff member's name, email, phone, sign-in details and the RideAuction authorities RideAuction gives them (for example to bid or submit units). 2.3 Bidding, purchases and offers. To run auctions and record binding commitments: every bid, Max Bid, Jump The Bid, Buy Now purchase, offer and acknowledgement, with the staff member and dealership, the server time, and technical information about the device's browser. Invoices, payments recorded, credit notes and settlements are kept with the sale. 2.4 Units, uploads and inspections. To describe units to buyers: photos, documents and the seller's disclosures; dealer-provided inspection information and reports; RideAuction condition reports and their photos; and the unit's location. On the public auction map the location is shown only approximately. 2.5 Title and release. To transfer ownership: ownership documents (title, registration, lien release, bill of sale, transfer forms), RideAuction's review notes, the authorized pickup party (name, company, phone, vehicle), the release verification and the record of release. 2.6 Delivery through Live Tracker. When a buyer chooses RideAuction delivery: the pickup and delivery addresses and contacts, the unit's details, the carrier and driver assigned, pickup and delivery inspections and photos, the recipient's name and signature at delivery, and messages about the shipment. 2.7 GPS and location data. While a driver is carrying out a delivery, from heading to pickup until arrival at the destination, the driver's device sends its location (about every 20 to 60 seconds) so the delivery can be tracked and its arrival time estimated. Location is not collected outside an active delivery. The buyer's tracking link shows the delivery's progress without the driver's personal details. 2.8 Disputes. To resolve a dispute: the claim, each party's statements, and the photos and documents added as evidence, with who may see each item. 2.9 Security and audit. To protect accounts and keep a reliable record: sign-in and session records, two-step verification records for administrators, audit logs of administrative actions, and records of bidding holds, buying limits and unusual-activity reviews. 2.10 Notifications. To keep users informed: the in-app notices sent to each staff member. ──────────────────────────────────────── 3. WHO CAN SEE IT ──────────────────────────────────────── 3.1 Other authenticated, currently eligible verified wholesale dealerships see the registered company name and company logo, business image or initials for bids newly authorized under the mandatory dealership-disclosure Terms described below. This is mandatory for future dealer bidding, without an opt-out. They never see individual staff identity, contacts, private Max Bid limits, a seller's reserve amount or another dealership's private offers. 3.2 A seller sees bidding company identities only when separately authorized as a currently eligible verified wholesale dealer under the same controls. Offering dealerships remain anonymous through the private offer pages. Earlier bids and commitments authorized under anonymity remain protected; public and unauthenticated visitors do not receive bidder company identities. 3.3 Carriers and their drivers receive the information needed to carry out a delivery. 3.4 RideAuction staff see information as needed to operate RideAuction, under access controls and two-step verification. 3.5 RideAuction uses service providers to operate the service, such as hosting and storage, mapping and geocoding, routing, push notifications, file virus scanning and backup. Some may process information outside Canada. 3.6 RideAuction does not sell personal information. ──────────────────────────────────────── 4. HOW LONG WE KEEP IT ──────────────────────────────────────── 4.1 Auction, sale, financial, title, dispute and audit records are kept as permanent records of binding transactions; RideAuction's systems do not delete them. 4.2 Live Tracker GPS points and delivery photo files. ──────────────────────────────────────── 5. YOUR CHOICES AND RIGHTS ──────────────────────────────────────── 5.1 You may ask RideAuction for access to, or correction of, your personal information, and ask questions or make a complaint, using the contact in section 1. ──────────────────────────────────────── 6. SECURITY ──────────────────────────────────────── 6.1 RideAuction protects personal information with access controls, encrypted connections, two-step verification for administrators and virus scanning of uploaded files. ──────────────────────────────────────── 7. CHANGES ──────────────────────────────────────── 7.1 RideAuction may publish a new version of this notice. Each version shows its version number and publication date. END OF DRAFT. ──────────────────────────────────────── PROPOSED DECISIONS AND PUBLICATION HOLDS ──────────────────────────────────────── PROPOSED / DEMO DECISIONS — NOT APPROVED OR IN EFFECT Operating location supplied by the owner: Edmonton, Alberta. The responsible legal entity, registered address and privacy contact have not been verified; this draft intentionally names none. Proposed scope applies Alberta PIPA where applicable and considers PIPEDA for federally regulated activity or interprovincial/international commercial flows. Counsel must determine the law applicable to each entity and data flow. Quebec Law 25 and French-language requirements are not asserted as resolved; no Quebec-facing publication/use until counsel confirms them. Operational data categories described above are based on observed RideAuction functions: dealer/staff identity and authorization; applications; auction and bid records; seller unit facts/media; approximate public lot location; invoices/payment/credits; title and pickup/release records; disputes and evidence; security/admin audit; and in-app notices. Precise driver location, recipient evidence and Live Tracker logistics data are included only when that separately deployed service is used; the draft does not claim universal collection. Current RideAuction notifications are in-app; email is deferred and SMS is OFF. Service-provider names, processing countries and retention implementation must be verified before publication; use of an outside-Canada provider requires clear disclosure of country, purpose and accountable contact as applicable. Proposed retention schedule for review—not configured facts: keep transaction, invoice, tax, title and audit records for the period required by law and a proposed 7-year business-record target; keep inactive account and routine security records only while needed and a proposed 24-month post-closure target; retain uploaded identity verification only for the verification purpose and a proposed 30-day post-decision target unless law, fraud prevention or an active dispute requires a documented hold; if Live Tracker location/photo retention is active, propose deletion or de-identification 90 days after delivery absent a legal hold. These targets must be checked against actual storage/backup deletion behavior before any claim that deletion occurs. Individuals may request access or correction through the verified support/contact channel once the responsible privacy contact is published. Proposed internal response target is 30 calendar days or sooner where law requires; it is not a substitute for statutory timelines. Records may be retained where legally required or needed to establish/defend claims. Complaints may be escalated to the applicable privacy regulator, including Alberta's OIPC or the federal Privacy Commissioner where jurisdiction applies; Quebec escalation is subject to legal review. For a suspected breach, contain, preserve evidence, assess real risk of significant harm and make regulator/individual notifications within the applicable legal deadlines. Maintain an incident record and contact owner. MANDATORY DEALERSHIP IDENTITY DISCLOSURE — OWNER DECISION, 2026-10-22 RIDEAUCTION-DEALER-IDENTITY-1 — Mandatory dealership identity disclosure. For every new dealer bid authorized after acceptance of these updated Terms, RideAuction displays the verified bidding dealership's registered company name and a small company logo, business image or company-initials avatar to other authenticated, currently eligible verified wholesale dealers. Disclosure is a mandatory condition of future manual bids, Quick Bid, Max Bid, Jump The Bid and advance-bid commitments; there is no opt-out. Staff must genuinely acknowledge the current published Terms before a new bid or commitment is accepted. Company identity appears consistently in current, earlier, expanded and real-time bid history on lot and auction pages, including the bidding dealer's own You / Highest Bidder entry. RideAuction uses reliable immutable company evidence and the Terms acceptance that existed when the original bid or commitment was authorized. Bids and proxy or advance commitments previously authorized under anonymity retain that treatment; a later acceptance or automatic proxy response does not retrospectively disclose them. Entries without reliable evidence remain anonymous and are never guessed from a later profile, ownership or company change. Public and unauthenticated visitors do not receive company identities. Individual staff identities, contacts, email addresses, private Max Bid limits and confidential account information remain confidential. An accepted public bid amount is visible without identifying it as a private maximum. A materially updated Terms version requires genuine renewed acknowledgement. This clause does not change bidding calculations, increments, proxy priority, reserves, fees, deadlines, existing commitments or security protections.